Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| snipe/snipe-it(Packagist) | 0 | 6.4.2 | N/A |
CVSS Metrics
